agent-dealer 1.3.2 → 1.3.4

package/bundle/server/dist/adapters/agent-health.test.js

@@ -17,6 +17,8 @@ const { migrate, getDb } = await import("../db/index.js");
 const { createAgent, getAgent } = await import("../repository/agents.js");
 const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, githubIssuesSync, classifyGithubAuthStatus, clearAgentHealthCaches, setCursorProbeTimingForTests, setRunCommandForTests, } = await import("./agent-health.js");
 const { setMuseCapabilityProbeForTests, settleMuseCapabilityCheckForTests } = await import("./muse-capability.js");
+const { recordMuseUsageCap } = await import("../runners/usage-cap.js");
+const { runtimeAvailability, clearAllRuntimeAvailability, } = await import("../repository/runtime-availability.js");
 migrate();
 // NOT-277: health never runs the real (billed) Muse capability probe in tests.
 setMuseCapabilityProbeForTests(async () => ({ status: "capable" }));
@@ -441,6 +443,56 @@ The keychain item is stuck. Delete it and sign in again:
         assert.match(issues[0].message, /panic: something else broke/);
         assert.doesNotMatch(issues[0].message, /muse login/);
     });
+    // ---------------------------------------------------------------------------
+    // NOT-439: agent health renders the exact provider boundary from persisted
+    // availability — the reproduced Muse message resolves to 11:59 AM in
+    // America/Los_Angeles, not the 11:46 AM of the old 30-minute fallback.
+    // ---------------------------------------------------------------------------
+    test("NOT-439: persisted muse provider reset renders the exact boundary, not the fallback", async () => {
+        clearAllRuntimeAvailability();
+        clearAgentHealthCaches();
+        try {
+            // Pinned incident replay: the provider said resets-at 18:59:01Z while the
+            // old fallback stored 18:46:20.154Z. Timezone-safe assertions on the
+            // stored instant itself.
+            const incidentNow = Date.parse("2026-10-12T18:16:20.154Z");
+            const cap = recordMuseUsageCap({
+                kind: "usage_cap",
+                message: "Subscription quota exhausted. Your usage window resets at 2026-10-12T18:59:01Z",
+            }, incidentNow);
+            assert.equal(cap?.unavailableUntil, "2026-10-12T18:59:01.000Z");
+            const stored = runtimeAvailability("muse_code", incidentNow);
+            assert.equal(stored.available, false);
+            if (!stored.available)
+                assert.equal(stored.until, "2026-10-12T18:59:01.000Z");
+            const la = { hour: "2-digit", minute: "2-digit", timeZone: "America/Los_Angeles" };
+            assert.equal(new Date("2026-10-12T18:59:01.000Z").toLocaleTimeString("en-US", la), "11:59 AM");
+            // The superseded fallback instant renders differently, proving the
+            // assertion distinguishes the two.
+            assert.equal(new Date("2026-10-12T18:46:20.154Z").toLocaleTimeString("en-US", la), "11:46 AM");
+            // Live surface: a guaranteed-future provider reset flows verbatim from
+            // persisted availability into the usage_capped health message.
+            const future = new Date(Date.now() + 2 * 3600_000);
+            future.setMilliseconds(0);
+            const resetIso = future.toISOString();
+            const live = recordMuseUsageCap({ kind: "usage_cap", message: `Subscription quota exhausted. Resets at ${resetIso}` });
+            assert.equal(live?.unavailableUntil, resetIso);
+            const stub = stubMuse(`cat ${JSON.stringify(path.join(FIXTURES, "muse-version.txt"))}`);
+            const agent = createAgent({ name: "muse-capped", runtime: "muse_code", deckId: randomUUID() });
+            const result = await withMuseEnv({ MUSE_CLI: stub.bin, META_API_KEY: "k", configHome: emptyConfigHome() }, () => healthForAgent(agent, true, undefined, true, null, NO_GITHUB));
+            const issue = result.issues.find((i) => i.code === "usage_capped");
+            assert.ok(issue, "expected a usage_capped issue from persisted availability");
+            const expectedRendering = new Date(resetIso).toLocaleTimeString([], {
+                hour: "2-digit",
+                minute: "2-digit",
+            });
+            assert.ok(issue.message.includes(expectedRendering), `expected health message ${JSON.stringify(issue.message)} to render ${expectedRendering}`);
+        }
+        finally {
+            clearAllRuntimeAvailability();
+            clearAgentHealthCaches();
+        }
+    });
     test("a muse probe that hangs past the timeout is runtime_unknown", async () => {
         const stub = stubMuse("sleep 30");
         setCursorProbeTimingForTests({ timeoutMs: 150 });

package/bundle/server/dist/capacity/service.js

@@ -5,12 +5,16 @@
 // profiles sharing one account produce one entry — each carrying whatever
 // windows the provider actually reported.
 //
-// Connection health, hard-cap availability, and remaining capacity stay
-// separate states: this service never reads `runtime_availability` and its
-// output never implies health. Only normalized snapshots leave this module —
-// evidence refs and raw provider payloads stay server-side.
+// Connection health and remaining capacity stay separate states: output never
+// implies health. Only normalized snapshots leave this module — evidence refs
+// and raw provider payloads stay server-side.
+//
+// NOT-440: an active hard cap (the same `runtime_availability` row that blocks
+// admission) rides alongside the windows as `activeCap`; stored snapshots are
+// never rewritten, and the overlay disappears with the row's lazy cleanup.
 import { isWindowKnown, Runtime as RuntimeSchema } from "@agent-dealer/shared";
 import { getDb } from "../db/index.js";
+import { activeRuntimeCap } from "../repository/runtime-availability.js";
 import { listAllCapacitySnapshots, recordCapacitySnapshots, } from "../repository/runtime-capacity.js";
 import { normalizeAdapterWindow, normalizeUnavailableWindow, } from "./adapter.js";
 /** Distinct runtimes across Agent profiles — the configured runtime accounts. */
@@ -83,6 +87,61 @@ function classifyWindow(w, nowMs) {
         known: false,
     };
 }
+const PAIR_RUNTIMES = new Set(["claude_code", "codex_local", "muse_code"]);
+const CURSOR_BILLING_WINDOW_KEY = "billing_cycle";
+/** Structured provider limit types that name a compact critical window. */
+const LIMIT_TYPE_ROLE = {
+    five_hour: "five_hour",
+    seven_day: "weekly",
+};
+/** A cap reset and a snapshot reset within this distance name the same boundary. */
+const RESET_MATCH_TOLERANCE_MS = 60_000;
+/** The compact role a stored window presents under, or null when it never renders compactly. */
+function compactRole(runtime, w) {
+    if (runtime === "cursor_local")
+        return w.windowKey === CURSOR_BILLING_WINDOW_KEY ? "billing_cycle" : null;
+    if (PAIR_RUNTIMES.has(runtime))
+        return w.criticalRole;
+    return null;
+}
+/**
+ * Which compact window an active cap exhausts: structured limit metadata
+ * first (a reported non-compact limit stays unmapped), then a tightly bounded
+ * match between the provider reset and exactly one tagged snapshot reset.
+ * A fallback-cooldown cap (no provider reset) is never matched.
+ */
+export function resolveCapWindowRole(runtime, cap, windows) {
+    if (cap.limitType !== null) {
+        const role = LIMIT_TYPE_ROLE[cap.limitType] ?? null;
+        return role !== null && PAIR_RUNTIMES.has(runtime) ? role : null;
+    }
+    if (cap.providerResetAt === null)
+        return null;
+    const capResetMs = Date.parse(cap.providerResetAt);
+    if (!Number.isFinite(capResetMs))
+        return null;
+    const matched = new Set();
+    for (const w of windows) {
+        const role = compactRole(runtime, w);
+        if (role === null || w.resetAt === null)
+            continue;
+        const resetMs = Date.parse(w.resetAt);
+        if (Number.isFinite(resetMs) && Math.abs(resetMs - capResetMs) <= RESET_MATCH_TOLERANCE_MS) {
+            matched.add(role);
+        }
+    }
+    return matched.size === 1 ? [...matched][0] : null;
+}
+function activeCapFor(runtime, windows, nowMs) {
+    const cap = activeRuntimeCap(runtime, nowMs);
+    if (cap === null)
+        return null;
+    return {
+        unavailableUntil: cap.unavailableUntil,
+        reason: cap.reason,
+        windowRole: resolveCapWindowRole(runtime, cap, windows),
+    };
+}
 /**
  * Read model for `GET /api/runtime-capacity`: every configured runtime, its
  * windows with freshness applied, and an explicit unavailable reason whenever
@@ -103,14 +162,15 @@ export function getRuntimeCapacitySnapshot(nowMs = Date.now()) {
     const entries = [...runtimes]
         .sort()
         .map((runtime) => {
-        const windows = (byRuntime.get(runtime) ?? []).map((w) => classifyWindow(w, nowMs).snapshot);
+        const raw = byRuntime.get(runtime) ?? [];
+        const windows = raw.map((w) => classifyWindow(w, nowMs).snapshot);
         const knownCount = windows.filter((w) => w.unavailableReason === null).length;
         let unavailableReason = null;
         if (knownCount === 0) {
             const first = windows.find((w) => w.unavailableReason)?.unavailableReason;
             unavailableReason = first ?? "missing";
         }
-        return { runtime, windows, unavailableReason };
+        return { runtime, windows, unavailableReason, activeCap: activeCapFor(runtime, raw, nowMs) };
     });
     return { runtimes: entries, generatedAt: new Date(nowMs).toISOString() };
 }

package/bundle/server/dist/capacity/service.test.js

@@ -219,3 +219,223 @@ test("a past reset time is never presented as current capacity", async () => {
     assert.equal(muse.windows[0].unavailableReason, "expired");
     assert.equal(muse.unavailableReason, "expired");
 });
+// NOT-440: active hard caps overlay the compact read model without rewriting
+// stored provider observations.
+const NOT440_NOW = Date.parse("2026-10-12T18:20:00.000Z");
+const NOT440_RESET = "2026-10-12T18:59:01.000Z";
+const NOT440_WEEKLY_RESET = "2026-10-16T02:00:00.000Z";
+async function seedPair(runtime, windows) {
+    const { recordCapacitySnapshots } = await import("../repository/runtime-capacity.js");
+    recordCapacitySnapshots(runtime, windows.map((w) => ({
+        windowKey: w.windowKey,
+        providerBucket: "all_models",
+        durationMinutes: w.durationMinutes ?? (w.criticalRole === "weekly" ? 10080 : 300),
+        displayLabel: w.criticalRole === "weekly" ? "1W" : "5H",
+        usedValue: 100 - w.remainingPercent,
+        usedUnit: "percent",
+        remainingPercent: w.remainingPercent,
+        resetAt: w.resetAt,
+        observedAt: "2026-10-12T18:03:00.000Z",
+        freshUntil: "2026-10-12T19:03:00.000Z",
+        expiresAt: "2026-10-12T19:03:00.000Z",
+        source: "observed_event",
+        unavailableReason: null,
+        criticalRole: w.criticalRole,
+    })));
+}
+async function seedReproducedMuse() {
+    await seedPair("muse_code", [
+        { windowKey: "five_hour", criticalRole: "five_hour", remainingPercent: 50, resetAt: NOT440_RESET },
+        { windowKey: "weekly", criticalRole: "weekly", remainingPercent: 52, resetAt: NOT440_WEEKLY_RESET },
+    ]);
+}
+function storedMuseRemaining() {
+    const rows = getDb()
+        .prepare("SELECT window_key, remaining_percent FROM runtime_capacity_snapshots WHERE runtime = 'muse_code'")
+        .all();
+    return Object.fromEntries(rows.map((r) => [r.window_key, r.remaining_percent]));
+}
+const { getDb } = await import("../db/index.js");
+const { clearAllRuntimeAvailability, recordRuntimeAvailability, runtimeAvailability } = await import("../repository/runtime-availability.js");
+const { recordMuseUsageCap } = await import("../runners/usage-cap.js");
+const { resolveCapWindowRole } = await import("./service.js");
+test("NOT-440: reproduced Muse cap maps to 5H without modifying stored snapshots", async () => {
+    clearAllCapacitySnapshots();
+    clearAllRuntimeAvailability();
+    await seedReproducedMuse();
+    assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+    recordMuseUsageCap({ kind: "usage_cap", message: `Subscription quota exhausted. Usage resets at 2026-10-12T18:59:01Z.` }, Date.parse("2026-10-12T18:16:00.000Z"));
+    const snap = getRuntimeCapacitySnapshot(NOT440_NOW);
+    const muse = snap.runtimes.find((r) => r.runtime === "muse_code");
+    assert.deepEqual(muse.activeCap, {
+        unavailableUntil: NOT440_RESET,
+        reason: muse.activeCap.reason,
+        windowRole: "five_hour",
+    });
+    assert.match(muse.activeCap.reason, /muse_code usage capped/);
+    // Windows remain the raw provider observation; the overlay is activeCap.
+    assert.equal(muse.windows.find((w) => w.criticalRole === "five_hour").remainingPercent, 50);
+    assert.equal(muse.windows.find((w) => w.criticalRole === "weekly").remainingPercent, 52);
+    assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+    // Admission/health read the same row.
+    assert.deepEqual(runtimeAvailability("muse_code", NOT440_NOW), {
+        available: false,
+        until: NOT440_RESET,
+        reason: muse.activeCap.reason,
+    });
+});
+test("NOT-440: overlay is absent at and after unavailableUntil; history is kept", async () => {
+    for (const offset of [0, 1]) {
+        clearAllCapacitySnapshots();
+        clearAllRuntimeAvailability();
+        await seedReproducedMuse();
+        recordMuseUsageCap({ kind: "usage_cap", message: `Subscription quota exhausted. Usage resets at 2026-10-12T18:59:01Z.` }, Date.parse("2026-10-12T18:16:00.000Z"));
+        const atMs = Date.parse(NOT440_RESET) + offset;
+        const snap = getRuntimeCapacitySnapshot(atMs);
+        const muse = snap.runtimes.find((r) => r.runtime === "muse_code");
+        assert.equal(muse.activeCap, null, `offset ${offset}ms`);
+        // Normal classification resumes: the 5H reset has passed, 1W is still current.
+        const fiveHour = muse.windows.find((w) => w.criticalRole === "five_hour");
+        assert.equal(fiveHour.remainingPercent, null);
+        assert.equal(fiveHour.unavailableReason, "expired");
+        assert.equal(muse.windows.find((w) => w.criticalRole === "weekly").remainingPercent, 52);
+        assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+        const capRows = getDb()
+            .prepare("SELECT COUNT(*) AS n FROM runtime_availability WHERE runtime = 'muse_code'")
+            .get();
+        assert.equal(capRows.n, 0, "lazy cleanup cleared the expired cap row");
+        assert.deepEqual(runtimeAvailability("muse_code", atMs), { available: true });
+    }
+});
+test("NOT-440: a cap with no provider reset or role stays unmapped (explicit capped)", async () => {
+    clearAllCapacitySnapshots();
+    clearAllRuntimeAvailability();
+    await seedReproducedMuse();
+    // Fallback cooldown that happens to land on the 5H reset is still not a provider boundary.
+    recordRuntimeAvailability({
+        runtime: "muse_code",
+        unavailableUntil: NOT440_RESET,
+        reason: "muse_code usage capped — usage cap",
+    });
+    const muse = getRuntimeCapacitySnapshot(NOT440_NOW).runtimes.find((r) => r.runtime === "muse_code");
+    assert.equal(muse.activeCap.windowRole, null);
+    assert.equal(muse.activeCap.unavailableUntil, NOT440_RESET);
+    assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+});
+const tagged = (windowKey, criticalRole, resetAt) => ({
+    windowKey,
+    providerBucket: "all_models",
+    durationMinutes: 300,
+    displayLabel: "5H",
+    usedValue: 50,
+    usedUnit: "percent",
+    remainingPercent: 50,
+    resetAt,
+    observedAt: "2026-10-12T18:03:00.000Z",
+    freshUntil: "2026-10-12T19:03:00.000Z",
+    expiresAt: "2026-10-12T19:03:00.000Z",
+    source: "observed_event",
+    unavailableReason: null,
+    criticalRole,
+});
+test("NOT-440: cap window role resolution per runtime (metadata first, then reset match)", () => {
+    const pair = [tagged("five_hour", "five_hour", NOT440_RESET), tagged("weekly", "weekly", NOT440_WEEKLY_RESET)];
+    const cases = [
+        {
+            name: "Claude five_hour metadata wins even without a reset match",
+            runtime: "claude_code",
+            cap: { providerResetAt: "2026-10-12T20:00:00.000Z", limitType: "five_hour" },
+            windows: pair,
+            expected: "five_hour",
+        },
+        {
+            name: "Claude seven_day metadata maps to weekly",
+            runtime: "claude_code",
+            cap: { providerResetAt: null, limitType: "seven_day" },
+            windows: pair,
+            expected: "weekly",
+        },
+        {
+            name: "Claude model-specific limit stays unmapped despite a matching weekly reset",
+            runtime: "claude_code",
+            cap: { providerResetAt: NOT440_WEEKLY_RESET, limitType: "seven_day_sonnet" },
+            windows: pair,
+            expected: null,
+        },
+        {
+            name: "Codex reset match on the weekly window",
+            runtime: "codex_local",
+            cap: { providerResetAt: NOT440_WEEKLY_RESET, limitType: null },
+            windows: pair,
+            expected: "weekly",
+        },
+        {
+            name: "Muse reset match on the 5H window (within tolerance)",
+            runtime: "muse_code",
+            cap: { providerResetAt: "2026-10-12T18:59:30.000Z", limitType: null },
+            windows: pair,
+            expected: "five_hour",
+        },
+        {
+            name: "Muse reset outside tolerance stays unmapped",
+            runtime: "muse_code",
+            cap: { providerResetAt: "2026-10-12T19:05:00.000Z", limitType: null },
+            windows: pair,
+            expected: null,
+        },
+        {
+            name: "Cursor reset match on the billing cycle",
+            runtime: "cursor_local",
+            cap: { providerResetAt: "2026-11-01T00:00:00.000Z", limitType: null },
+            windows: [tagged("billing_cycle", null, "2026-11-01T00:00:00.000Z")],
+            expected: "billing_cycle",
+        },
+        {
+            name: "Untagged diagnostic window with a matching reset never maps",
+            runtime: "muse_code",
+            cap: { providerResetAt: "2026-10-13T00:00:00.000Z", limitType: null },
+            windows: [...pair, tagged("muse_account_usage", null, "2026-10-13T00:00:00.000Z")],
+            expected: null,
+        },
+        {
+            name: "Fallback cooldown (no provider reset) never maps",
+            runtime: "codex_local",
+            cap: { providerResetAt: null, limitType: null },
+            windows: pair,
+            expected: null,
+        },
+        {
+            name: "Ambiguous reset matching both pair windows stays unmapped",
+            runtime: "codex_local",
+            cap: { providerResetAt: NOT440_RESET, limitType: null },
+            windows: [tagged("five_hour", "five_hour", NOT440_RESET), tagged("weekly", "weekly", NOT440_RESET)],
+            expected: null,
+        },
+    ];
+    for (const c of cases) {
+        assert.equal(resolveCapWindowRole(c.runtime, c.cap, c.windows), c.expected, c.name);
+    }
+});
+test("NOT-440: Claude structured rate_limit_event persists limit type and maps through the read model", async () => {
+    clearAllCapacitySnapshots();
+    clearAllRuntimeAvailability();
+    await seedPair("claude_code", [
+        { windowKey: "five_hour", criticalRole: "five_hour", remainingPercent: 40, resetAt: NOT440_RESET },
+        { windowKey: "weekly", criticalRole: "weekly", remainingPercent: 70, resetAt: NOT440_WEEKLY_RESET },
+    ]);
+    const { recordUsageCapFromEvents } = await import("../runners/usage-cap.js");
+    recordUsageCapFromEvents([
+        {
+            type: "rate_limit_event",
+            rate_limit_info: {
+                status: "rejected",
+                rateLimitType: "seven_day",
+                resetsAt: Math.floor(Date.parse(NOT440_WEEKLY_RESET) / 1000),
+            },
+        },
+    ], "claude_code", NOT440_NOW);
+    const claude = getRuntimeCapacitySnapshot(NOT440_NOW).runtimes.find((r) => r.runtime === "claude_code");
+    assert.equal(claude.activeCap.windowRole, "weekly");
+    assert.equal(claude.activeCap.unavailableUntil, NOT440_WEEKLY_RESET);
+    clearAllRuntimeAvailability();
+});

package/bundle/server/dist/coordinator/commands.js

@@ -32,7 +32,7 @@ import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 import { projectDeveloperRoute, projectReviewerRoute } from "./projection.js";
 import { MERGE_CONFLICT_FILES_EVIDENCE_KEY, MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, WORKTREE_BLOCKER_EVIDENCE_KEY, normalizeResolutionNote, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
 import { AUTH_TRANSIENT_RETRY_PAYLOAD_KEY, RUNTIME_AUTH_PARK_EVIDENCE_KEY, authProbeConfirmsFailure, defaultRemediationForRuntime, gateRuntimeAuthParkResume, parseRuntimeAuthParkEvidence, remediationFromProbe, } from "./runtime-auth-park.js";
-import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
+import { AUTO_MERGE_INTENT, OPERATOR_VERIFICATION_INTENT, finalizeAutoMerge } from "./auto-merge.js";
 import { triggerLinearPostMerge } from "./linear-merge-verify.js";
 import { conflictRepairSpent, queueConflictRepairRound } from "./merge-conflict-sync.js";
 import { OPERATOR_VERIFICATION_ARTIFACT_KIND, OPERATOR_VERIFICATION_RESPONSE_OPTIONS, } from "./operator-criteria.js";
@@ -261,6 +261,84 @@ export function applyParkedEdit(issueId, patch) {
         throw err;
     }
 }
+export function autoMergePolicyEditability(issue) {
+    switch (issue.status) {
+        case "ready":
+            return { editable: true, reason: null };
+        case "developing":
+        case "reviewing":
+        case "repairing":
+            return getActiveWorkflowInstance(issue.id)
+                ? { editable: true, reason: null }
+                : { editable: false, reason: "No active workflow is running for this issue." };
+        case "needs_human": {
+            const open = listHumanActionsForIssue(issue.id).filter((a) => a.status === "open");
+            // The operator-verification gate runs after approval routing: resolving it continues
+            // the already-committed merge path, so the policy is locked while it is open.
+            if (issue.currentIntent === OPERATOR_VERIFICATION_INTENT ||
+                open.some((a) => a.actionType === "operator_verification")) {
+                return {
+                    editable: false,
+                    reason: "The reviewer approved and the merge decision is committed — it waits only on operator verification.",
+                };
+            }
+            // Merge-failure parks, including the no-head operator-verification escalation.
+            if (open.some((a) => a.actionType === "policy_escalation" && isMergeFailureAction(a))) {
+                return {
+                    editable: false,
+                    reason: "The reviewer approved and the merge was already attempted — use the merge-failure action instead.",
+                };
+            }
+            return { editable: true, reason: null };
+        }
+        case "final_review":
+            return {
+                editable: false,
+                reason: issue.currentOwner === "system" && issue.currentIntent === AUTO_MERGE_INTENT
+                    ? "The reviewer approved and auto-merge is already in flight."
+                    : "The reviewer approved and the merge decision is committed — use Merge on the final review action.",
+            };
+        case "done":
+        case "closed":
+            return { editable: false, reason: `The issue is ${issue.status}.` };
+    }
+}
+/**
+ * NOT-490: an `autoMerge`-only update — the one input that may change during a live
+ * round, because nothing reads it until approved-review routing. Guard re-check, row
+ * write and audit run in one SQLite transaction, which serializes against the
+ * reviewer-completion transaction: an update committed first is the value
+ * `applyReviewer` routes on; a reviewer decision committed first moves the issue to
+ * `final_review` and this answers 409, so one approval can never yield both an
+ * auto-merge and a `final_review` action. Queue entry, frozen snapshot, agents,
+ * budgets, branch and PR are untouched (`updateIssue` writes only the policy column
+ * here). A real change appends one `issue.reassigned` event with before/after values
+ * and the actor; a no-op appends nothing.
+ */
+export function applyAutoMergePolicyUpdate(issueId, autoMerge, actor) {
+    return getDb().transaction(() => {
+        const fresh = getIssue(issueId);
+        if (!fresh)
+            return { ok: false, code: 404, error: "Not found" };
+        const editability = autoMergePolicyEditability(fresh);
+        if (!editability.editable) {
+            return { ok: false, code: 409, error: `Auto-merge can no longer be changed: ${editability.reason}` };
+        }
+        if (fresh.autoMerge === autoMerge)
+            return { ok: true, issue: fresh, changed: false };
+        const next = updateIssue(issueId, { autoMerge });
+        appendWorkflowEvent({
+            issueId,
+            workflowInstanceId: getActiveWorkflowInstance(issueId)?.id ?? null,
+            type: "issue.reassigned",
+            actorType: "human",
+            stage: next.status,
+            round: next.currentRound,
+            payload: { fromAutoMerge: fresh.autoMerge, toAutoMerge: next.autoMerge, actor },
+        });
+        return { ok: true, issue: next, changed: true };
+    })();
+}
 /**
  * Stable identity-plus-bytes key for one attachment manifest entry. blobPath is
  * excluded: it is content-addressed from the compared fields under an

package/bundle/server/dist/coordinator/commands.test.js

@@ -42,6 +42,8 @@ function newIssue(opts = {}) {
         baseBranch: "main",
         maxReviewRounds: opts.maxReviewRounds ?? 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/developer-effect.test.js

@@ -89,6 +89,8 @@ async function makeIssue(opts = {}) {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/repair-cycle.integration.test.js

@@ -84,6 +84,8 @@ async function makeIssue() {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/reviewer-effect.test.js

@@ -104,6 +104,8 @@ async function makeIssue(opts = {}) {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/worker-loop.test.js

@@ -51,6 +51,8 @@ function newIssue(maxReviewRounds = 3) {
         baseBranch: "main",
         maxReviewRounds,
         maxInfraAttempts: 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/db/auto-merge-default-migration.test.js

@@ -0,0 +1,52 @@
+// NOT-489: a clean install's `issues.auto_merge` column defaults on, while an upgrade
+// never rewrites an existing issue's stored choice — and new creates on the upgraded
+// database still take the shared `CreateIssueInput` default (true), not the column's.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import Database from "better-sqlite3";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-auto-merge-migrate-"));
+const { migrate, getDb } = await import("./index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const autoMergeDefault = (db) => db.prepare("PRAGMA table_info(issues)").all().find((c) => c.name === "auto_merge").dflt_value;
+const storedAutoMerge = (id) => getDb().prepare("SELECT auto_merge FROM issues WHERE id = ?").get(id).auto_merge;
+function newIssueId(autoMerge) {
+    return createIssue({
+        title: "T",
+        repo: "github.com/acme/app",
+        baseBranch: "main",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+        ...(autoMerge === undefined ? {} : { autoMerge }),
+    }).id;
+}
+test("a clean schema defaults auto_merge on", () => {
+    const db = new Database(":memory:");
+    db.exec(fs.readFileSync(path.join(__dirname, "schema.sql"), "utf8"));
+    assert.equal(autoMergeDefault(db), "1");
+});
+test("upgrading preserves every stored auto_merge value; post-upgrade omitted-field creates still get true", () => {
+    migrate();
+    const optedOut = newIssueId(false);
+    const optedIn = newIssueId(true);
+    // An upgraded database whose column predates NOT-489 (still DEFAULT 0).
+    getDb().exec("ALTER TABLE issues DROP COLUMN auto_merge");
+    getDb().exec("ALTER TABLE issues ADD COLUMN auto_merge INTEGER NOT NULL DEFAULT 0");
+    getDb().prepare("UPDATE issues SET auto_merge = 1 WHERE id = ?").run(optedIn);
+    assert.equal(autoMergeDefault(getDb()), "0");
+    migrate();
+    assert.equal(storedAutoMerge(optedOut), 0, "a pre-existing false row is not rewritten");
+    assert.equal(getIssue(optedOut).autoMerge, false);
+    assert.equal(storedAutoMerge(optedIn), 1);
+    const fresh = newIssueId();
+    assert.equal(storedAutoMerge(fresh), 1, "an omitted-field create on the upgraded DB stores true");
+    assert.equal(getIssue(fresh).autoMerge, true);
+});

package/bundle/server/dist/db/index.js

@@ -264,8 +264,10 @@ export function migrate() {
     if (!issueColsForCi.some((c) => c.name === "ci_attempts")) {
         db.exec("ALTER TABLE issues ADD COLUMN ci_attempts INTEGER NOT NULL DEFAULT 0");
     }
-    // NOT-102: per-issue auto-merge after reviewer approve (kick UI defaults on; existing
-    // rows stay off so in-flight workflows keep the human final_review path).
+    // NOT-102: per-issue auto-merge after reviewer approve. Rows that predate the column
+    // backfill off so in-flight workflows keep the human final_review path. NOT-489: new
+    // creates write the shared `CreateIssueInput` default (true) explicitly, so this
+    // backfill DEFAULT never decides a new issue's policy and stays 0 to preserve old rows.
     const issueColsForAutoMerge = db.prepare("PRAGMA table_info(issues)").all();
     if (!issueColsForAutoMerge.some((c) => c.name === "auto_merge")) {
         db.exec("ALTER TABLE issues ADD COLUMN auto_merge INTEGER NOT NULL DEFAULT 0");
@@ -378,6 +380,14 @@ export function migrate() {
       );
     `);
     }
+    // NOT-440: normalized cap metadata for capacity reconciliation.
+    const runtimeAvailCols = db.prepare("PRAGMA table_info(runtime_availability)").all();
+    if (!runtimeAvailCols.some((c) => c.name === "provider_reset_at")) {
+        db.exec("ALTER TABLE runtime_availability ADD COLUMN provider_reset_at TEXT");
+    }
+    if (!runtimeAvailCols.some((c) => c.name === "limit_type")) {
+        db.exec("ALTER TABLE runtime_availability ADD COLUMN limit_type TEXT");
+    }
     // NOT-245: normalized capacity snapshots for databases created before
     // schema.sql declared the table (same upgrade-path pattern as queue_entries).
     const capacitySnapshots = db

package/bundle/server/dist/db/schema.sql

@@ -121,7 +121,7 @@ CREATE TABLE IF NOT EXISTS issues (
   head_sha TEXT,
   pr_number INTEGER,
   pr_url TEXT,
-  auto_merge INTEGER NOT NULL DEFAULT 0,
+  auto_merge INTEGER NOT NULL DEFAULT 1,
   created_at TEXT NOT NULL,
   updated_at TEXT NOT NULL
 );
@@ -473,7 +473,11 @@ CREATE TABLE IF NOT EXISTS runtime_availability (
   unavailable_until TEXT NOT NULL,
   reason TEXT NOT NULL,
   evidence_json TEXT,
-  observed_at TEXT NOT NULL
+  observed_at TEXT NOT NULL,
+  -- NOT-440: provider-reported reset (null when unavailable_until is the
+  -- fallback cooldown) and structured provider limit type, if any.
+  provider_reset_at TEXT,
+  limit_type TEXT
 );
 
 -- NOT-171: append-only normalized failure-cause evidence. A derived view over

package/bundle/server/dist/dev-review-cli-happy-path.integration.test.js

@@ -280,6 +280,8 @@ test("agent-operated CLI: discover profiles, create + start a Dev-review issue,
         "Widget renders.",
         "--base-branch",
         "main",
+        // NOT-489: auto-merge is the default; this walk drives the final-review action.
+        "--no-auto-merge",
     ]));
     const issueId = created.id;
     assert.equal(created.status, "ready");